Skip to content
OpenAdvisories
Medium · 4.8 CVE-2024-31079 EUVD-2024-34446

NGINX HTTP/3 QUIC vulnerability

Published May 29, 2024 · Updated Feb 13, 2025 · Assigned by f5

Vendor: F5 Product: NGINX Open Source Product: NGINX Plus Package: nginx Package: nginx-mainline Package: nginx-mainline-config Package: nginx-mainline-config-compat Package: nginx-mainline-mod-http_geoip Package: nginx-mainline-mod-http_image_filter Package: nginx-mainline-mod-http_perl Package: nginx-mainline-mod-http_xslt_filter Package: nginx-mainline-mod-mail Package: nginx-mainline-mod-stream Package: nginx-mainline-mod-stream_geoip Package: nginx-mainline-openrc Package: nginx-mainline-package-config Package: nginx-mainline-src Package: nginx-mainline-syslog-config Package: nginx-stable Category: Network devices Ecosystem: Debian Ecosystem: Wolfi

Description

When NGINX Plus or NGINX OSS are configured to use the HTTP/3 QUIC module, undisclosed HTTP/3 requests can cause NGINX worker processes to terminate or cause other potential impact. This attack requires that a request be specifically timed during the connection draining process, which the attacker has no visibility and limited influence over.

Affected products

VendorProductAffectedFixed
F5 NGINX Open Source 1.25.0 – < 1.26.1 1.26.1
F5 NGINX Plus R30 – < R32 R32

Fixed in Linux distributions

Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.

Debian

Security tracker ↗
ReleasePackageFixed inAdvisory
Debian 14 nginx 1.26.0-2 —
Debian 13 nginx 1.26.0-2 —

Wolfi

ReleasePackageFixed inAdvisory
Wolfi rolling nginx-mainline +13 1.27.0-r0 —
Wolfi rolling nginx-stable 1.26.1-r0 —

Advisories 2

References